emotet | 6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729

General

Target
6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729.exe
Size 528KB
Sample201108-ret9b9dekj
SHA256 6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729
MD5 91069647824563dce4341d42eab3f536
SHA1 187a117c79f7da7350737d0a1f4733dcbb01769f
SHA512 ced73f6fae5094540074ecc5578a7a1c5c6483b98e345548b4d85a66a6db2091bd25a77ecf15f719038ecf0afbe6405bc97f6c01d464ec73fb281c00ed2dc95a
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Extracted

Family

emotet

C2

186.92.11.143:8080
200.30.227.135:80
178.249.187.151:8080
81.169.140.14:443
94.177.183.28:8080
89.188.124.145:443
185.86.148.222:8080
82.196.15.205:8080
77.245.101.134:8080
217.199.160.224:8080
76.69.29.42:80
181.59.253.20:21
46.28.111.142:7080
149.62.173.247:8080
200.58.83.179:80
190.230.60.129:80
181.36.42.205:443
190.97.30.167:990
46.29.183.211:8080
87.106.77.40:7080
212.71.237.140:8080
151.80.142.33:80
185.187.198.10:8080
190.146.131.105:8080
5.196.35.138:7080
119.59.124.163:8080
190.10.194.42:8080
183.82.97.25:80
79.127.57.43:80
203.25.159.3:8080
69.163.33.84:8080
45.79.95.107:443
178.79.163.131:8080
46.41.151.103:8080
91.204.163.19:8090
62.75.160.178:8080
200.113.106.18:80
46.101.212.195:8080
144.139.158.155:80
50.28.51.143:8080
200.58.171.51:80
190.230.60.129:8080
91.205.215.57:7080
80.85.87.122:8080
14.160.93.230:80
62.75.143.100:7080
200.57.102.71:8443
94.183.71.206:7080
138.68.106.4:7080
79.143.182.254:8080
46.163.144.228:80
79.129.0.173:8080
68.183.170.114:8080
86.42.166.147:80
190.104.253.234:990
190.85.152.186:8080
170.84.133.72:7080
201.163.74.202:443
159.203.204.126:8080
186.68.141.218:80
51.15.8.192:8080
186.1.41.111:443
109.169.86.13:8080
181.16.17.210:443
119.159.150.176:443
181.135.153.203:443
139.5.237.27:443
91.83.93.124:7080
187.193.89.61:50000
77.55.211.77:8080
181.44.166.242:80
186.23.132.93:990
181.51.251.236:443
68.183.190.199:8080
104.131.58.132:8080
186.0.95.172:80
190.1.37.125:443
190.38.14.52:80

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	tlbijpn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	tlbijpn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	tlbijpn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	tlbijpn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	tlbijpn.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	tlbijpn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	tlbijpn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	tlbijpn.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

pid	Process
4960	6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729.exe
3840	tlbijpn.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3840	tlbijpn.exe
3840	tlbijpn.exe
3840	tlbijpn.exe
3840	tlbijpn.exe
3840	tlbijpn.exe
3840	tlbijpn.exe
3840	tlbijpn.exe
3840	tlbijpn.exe
3840	tlbijpn.exe
3840	tlbijpn.exe
3840	tlbijpn.exe
3840	tlbijpn.exe
3840	tlbijpn.exe
3840	tlbijpn.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4960	6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4640	6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729.exe
4640	6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729.exe
4960	6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729.exe
4960	6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729.exe
4236	tlbijpn.exe
4236	tlbijpn.exe
3840	tlbijpn.exe
3840	tlbijpn.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 4960	4640	6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729.exe	74
PID 4640 wrote to memory of 4960	4640	6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729.exe	74
PID 4640 wrote to memory of 4960	4640	6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729.exe	74
PID 4236 wrote to memory of 3840	4236	tlbijpn.exe	80
PID 4236 wrote to memory of 3840	4236	tlbijpn.exe	80
PID 4236 wrote to memory of 3840	4236	tlbijpn.exe	80

C:\Users\Admin\AppData\Local\Temp\6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729.exe
"C:\Users\Admin\AppData\Local\Temp\6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\6b7ebd5fb9b2a26568d63d9ae3fe9b35ea2ea50e030a24a6b49b0e95ba291729.exe
  --5eae2cef
  2⤵
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: RenamesItself
  - Suspicious use of SetWindowsHookEx
  PID:4960

C:\Windows\SysWOW64\tlbijpn.exe
"C:\Windows\SysWOW64\tlbijpn.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\tlbijpn.exe
  --ac74a2df
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EmotetMutantsSpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3840-6-0x0000000000D50000-0x0000000000D66000-memory.dmp

Download

memory/3840-7-0x0000000000400000-0x0000000000487000-memory.dmp

Download

memory/4236-4-0x0000000000580000-0x0000000000596000-memory.dmp

Download

memory/4640-0-0x0000000000640000-0x0000000000656000-memory.dmp

Download

memory/4960-2-0x0000000002050000-0x0000000002066000-memory.dmp

Download

memory/4960-3-0x0000000000400000-0x0000000000487000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads